From afb3f7e754bde70895d639ff2a2738409a51c60e Mon Sep 17 00:00:00 2001
From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date: Wed, 1 Jul 2009 17:31:25 -0300
Subject: bug: 'luaV_settable' may invalidate a reference to a table and try to
 reuse it.

---
 lvm.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lvm.c b/lvm.c
index 7603af7a..9ba3131e 100644
--- a/lvm.c
+++ b/lvm.c
@@ -1,5 +1,5 @@
 /*
-** $Id: lvm.c,v 2.92 2009/06/17 16:17:14 roberto Exp roberto $
+** $Id: lvm.c,v 2.93 2009/06/17 17:50:09 roberto Exp roberto $
 ** Lua virtual machine
 ** See Copyright Notice in lua.h
 */
@@ -115,7 +115,7 @@ void luaV_gettable (lua_State *L, const TValue *t, TValue *key, StkId val) {
       callTM(L, tm, t, key, val, 1);
       return;
     }
-    t = tm;  /* else repeat with `tm' */
+    t = tm;  /* else repeat with 'tm' */
   }
   luaG_runerror(L, "loop in gettable");
 }
@@ -123,6 +123,7 @@ void luaV_gettable (lua_State *L, const TValue *t, TValue *key, StkId val) {
 
 void luaV_settable (lua_State *L, const TValue *t, TValue *key, StkId val) {
   int loop;
+  TValue temp;
   for (loop = 0; loop < MAXTAGLOOP; loop++) {
     const TValue *tm;
     if (ttistable(t)) {  /* `t' is a table? */
@@ -142,7 +143,9 @@ void luaV_settable (lua_State *L, const TValue *t, TValue *key, StkId val) {
       callTM(L, tm, t, key, val, 0);
       return;
     }
-    t = tm;  /* else repeat with `tm' */
+    /* else repeat with 'tm' */
+    setobj(L, &temp, tm);  /* avoid pointing inside table (may rehash) */
+    t = &temp;
   }
   luaG_runerror(L, "loop in settable");
 }
-- 
cgit v1.2.3-55-g6feb